by Kastro
Paper/Archive/CVE-2025-54592

CVE-2025-54592

FreshRSS FreshRSS — FreshRSS has Incomplete Session Termination on Logout

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.8.448 × 209.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

Affected

ProductAffectedFixed inSource
FreshRSS< 1.27.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgrrefgithub.com/FreshRSS/FreshRSS/pull/7762refgithub.com/FreshRSS/FreshRSS/releases/tag/1.27.0